feat(cosmos): mitigate `install-bundle` RPC limits by chunking #11202

michaelfig · 2025-04-02T04:27:14Z

closes: #XXXX
refs: #XXXX

Description

Security Considerations

Scaling Considerations

Documentation Considerations

Testing Considerations

Upgrade Considerations

cloudflare-workers-and-pages · 2025-04-02T05:01:29Z

Deploying agoric-sdk with Cloudflare Pages

Latest commit:	`6dcbe8c`
Status:	✅ Deploy successful!
Preview URL:	https://c4b13578.agoric-sdk.pages.dev
Branch Preview URL:	https://mfig-bundle-chunks.agoric-sdk.pages.dev

View logs

gibson042

First-pass comments, limited to the RPC/protobuf API.

gibson042 · 2025-04-04T17:52:03Z

golang/cosmos/proto/agoric/swingset/msgs.proto


 option go_package = "github.com/Agoric/agoric-sdk/golang/cosmos/x/swingset/types";

 // Transactions.
 service Msg {
  // Install a JavaScript sources bundle on the chain's SwingSet controller.
  rpc InstallBundle(MsgInstallBundle) returns (MsgInstallBundleResponse);
+  // Send a chunk of a bundle to tolerate bandwidth constraints.


Suggested change

// Send a chunk of a bundle to tolerate bandwidth constraints.

// Send a chunk of an artifact to tolerate RPC message size constraints.

gibson042 · 2025-04-04T17:54:29Z

golang/cosmos/proto/agoric/swingset/msgs.proto

@@ -122,18 +125,70 @@ message MsgInstallBundle {
        (gogoproto.jsontag)    = "submitter",
        (gogoproto.moretags)   = "yaml:\"submitter\""
    ];
-    // Either bundle or compressed_bundle will be set.
+    // Either bundle, compressed_bundle, or bundle_chunks will be set.


Suggested change

// Either bundle, compressed_bundle, or bundle_chunks will be set.

// Of the fields for (complete, uncompressed) bundle, (complete) compressed

// bundle, and chunked bundle, exactly one must be non-empty.

gibson042 · 2025-04-04T18:05:57Z

golang/cosmos/proto/agoric/swingset/msgs.proto

 // MsgInstallBundleResponse is an empty acknowledgement that an install bundle
 // message has been queued for the SwingSet kernel's consideration.


Suggested change

// MsgInstallBundleResponse is an empty acknowledgement that an install bundle

// message has been queued for the SwingSet kernel's consideration.

// MsgInstallBundleResponse is either an empty acknowledgement that an install

// bundle message has been queued for the SwingSet kernel's consideration, or

// (for install bundle messages that specify chunking) a container for the

// assigned id with which chunks must be associated.

gibson042 · 2025-04-04T18:06:10Z

golang/cosmos/proto/agoric/swingset/msgs.proto

 }

 // MsgInstallBundleResponse is an empty acknowledgement that an install bundle
 // message has been queued for the SwingSet kernel's consideration.
-message MsgInstallBundleResponse {}
+message MsgInstallBundleResponse {
+    // The assigned pending installation, if chunks were specified.


Suggested change

// The assigned pending installation, if chunks were specified.

gibson042 · 2025-04-04T18:15:06Z

golang/cosmos/proto/agoric/swingset/swingset.proto

+    // The hash of the complete bundle.
+    string bundle_hash = 1 [
+        (gogoproto.jsontag)    = "bundle_hash",
+        (gogoproto.moretags)   = "yaml:\"bundle_hash\""
+    ];


There's no analog for this in MsgInstallBundle for the full uploads... what purpose is it serving here? If we're worried about corruption from someone uploading a chunk of a bundle without authority to do so, then I think we should instead be using cryptographic security (e.g., the initiator indicates authorized public keys). But in any case, we can't have such a field without documenting how to determine the associated algorithm (e.g., SHA-512).

gibson042 · 2025-04-04T19:40:29Z

golang/cosmos/proto/agoric/swingset/query.proto

+  int64 start_block = 4 [
+    (gogoproto.jsontag)    = "start_block",
+    (gogoproto.moretags)   = "yaml:\"start_block\""
+  ];


Suggested change

int64 start_block = 4 [

(gogoproto.jsontag) = "start_block",

(gogoproto.moretags) = "yaml:\"start_block\""

];

int64 start_height = 4 [

(gogoproto.jsontag) = "start_height",

(gogoproto.moretags) = "yaml:\"start_height\""

];

gibson042 · 2025-04-04T19:44:38Z

golang/cosmos/proto/agoric/swingset/swingset.proto

+    // The maximum number of blocks that an async installation can use.  -1 is
+    // unlimited.
+    int64 installation_deadline_blocks = 7 [
+      (gogoproto.jsontag)    = "installation_deadline_blocks",
+      (gogoproto.moretags)   = "yaml:\"installation_deadline_blocks\""
+    ];
+
+    // The maximum number of seconds that an async installation can use.  -1 is
+    // unlimited.
+    int64 installation_deadline_seconds = 8 [
+      (gogoproto.jsontag)    = "installation_deadline_seconds",
+      (gogoproto.moretags)   = "yaml:\"installation_deadline_seconds\""
+    ];


Suggested change

// The maximum number of blocks that an async installation can use. -1 is

// unlimited.

int64 installation_deadline_blocks = 7 [

(gogoproto.jsontag) = "installation_deadline_blocks",

(gogoproto.moretags) = "yaml:\"installation_deadline_blocks\""

];

// The maximum number of seconds that an async installation can use. -1 is

// unlimited.

int64 installation_deadline_seconds = 8 [

(gogoproto.jsontag) = "installation_deadline_seconds",

(gogoproto.moretags) = "yaml:\"installation_deadline_seconds\""

];

// The maximum number of blocks between creation of a chunked artifact and

// receipt of its final chunk. -1 is unlimited.

int64 chunked_artifact_deadline_blocks = 7 [

(gogoproto.jsontag) = "chunked_artifact_deadline_blocks",

(gogoproto.moretags) = "yaml:\"chunked_artifact_deadline_blocks\""

];

// The maximum number of seconds between creation of a chunked artifact and

// receipt of its final chunk. -1 is unlimited.

int64 chunked_artifact_deadline_seconds = 8 [

(gogoproto.jsontag) = "chunked_artifact_deadline_seconds",

(gogoproto.moretags) = "yaml:\"chunked_artifact_deadline_seconds\""

];

gibson042 · 2025-04-04T19:48:38Z

golang/cosmos/proto/agoric/swingset/swingset.proto

+  // Doubly-linked list in order of start block and time.
+  uint64 first_pending_id = 2 [
+    (gogoproto.jsontag)    = "first_pending_id",
+    (gogoproto.moretags)   = "yaml:\"first_pending_id\""
+  ];
+
+  // The last pending id that has not expired or completed.
+  uint64 last_pending_id = 3 [
+    (gogoproto.jsontag)    = "last_pending_id",
+    (gogoproto.moretags)   = "yaml:\"last_pending_id\""
+  ];


Suggested change

// Doubly-linked list in order of start block and time.

uint64 first_pending_id = 2 [

(gogoproto.jsontag) = "first_pending_id",

(gogoproto.moretags) = "yaml:\"first_pending_id\""

];

// The last pending id that has not expired or completed.

uint64 last_pending_id = 3 [

(gogoproto.jsontag) = "last_pending_id",

(gogoproto.moretags) = "yaml:\"last_pending_id\""

];

// The head of a doubly-linked list of pending chunked artifacts ordered by

// ascending start block and time (i.e., the ID of the oldest).

uint64 first_chunked_artifact_id = 2 [

(gogoproto.jsontag) = "first_chunked_artifact_id",

(gogoproto.moretags) = "yaml:\"first_chunked_artifact_id\""

];

// The tail of a doubly-linked list of pending chunked artifacts ordered by

// ascending start block and time (i.e., the ID of the youngest).

uint64 last_chunked_artifact_id = 3 [

(gogoproto.jsontag) = "last_chunked_artifact_id",

(gogoproto.moretags) = "yaml:\"last_chunked_artifact_id\""

];

gibson042 · 2025-04-04T19:49:09Z

golang/cosmos/proto/agoric/swingset/swingset.proto

+  // The chunk is still in-flight.
+  CHUNK_STATE_IN_FLIGHT = 1;
+
+  // The chunk has been received.
+  CHUNK_STATE_RECEIVED = 2;
+
+  // The chunk has been processed.
+  CHUNK_STATE_PROCESSED = 3;


What are the definitions of these states?

gibson042 · 2025-04-04T19:55:29Z

golang/cosmos/proto/agoric/swingset/swingset.proto

+// The pending installation node in the doubly-linked list of pending
+// installations in descending order of age.  This is used to track the state of
+// a pending installation and to expire them efficiently.
+message PendingInstallNode{
+    // The id of the pending bundle installation.
+    uint64 pending_id = 1 [


Suggested change

// The pending installation node in the doubly-linked list of pending

// installations in descending order of age. This is used to track the state of

// a pending installation and to expire them efficiently.

message PendingInstallNode{

// The id of the pending bundle installation.

uint64 pending_id = 1 [

// A node in the doubly-linked list of pending chunked artifacts ordered by

// ascending start block and time. This is used to efficiently expire stale

// chunked artifacts.

message PendingInstallNode{

// The id of the incomplete chunked artifact.

uint64 chunked_artifact_id = 1 [

michaelfig changed the title ~~feat: mitigate agd tx swingset install-bundle RPC size limits by chunking~~ feat(cosmos): mitigate install-bundle RPC limits by chunking Apr 2, 2025

michaelfig force-pushed the mfig-bundle-chunks branch from 418cd9d to cd634f7 Compare April 2, 2025 05:01

michaelfig force-pushed the mfig-bundle-chunks branch from cd634f7 to 7fdba5d Compare April 2, 2025 05:55

michaelfig added 5 commits April 2, 2025 10:47

feat(cosmos): first cut at install chunking proto

a5248d2

chore(cosmos): make proto-gen

10110b3

chore(cosmic-proto): yarn codegen

dc183b3

test(cosmic-proto): update golden snapshots

73d1391

feat(cosmos): support InstallBundle and SendChunk

6dcbe8c

michaelfig force-pushed the mfig-bundle-chunks branch from 7fdba5d to 6dcbe8c Compare April 2, 2025 16:48

michaelfig self-assigned this Apr 3, 2025

gibson042 reviewed Apr 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cosmos): mitigate `install-bundle` RPC limits by chunking #11202

feat(cosmos): mitigate `install-bundle` RPC limits by chunking #11202

michaelfig commented Apr 2, 2025

cloudflare-workers-and-pages bot commented Apr 2, 2025 •

edited

Loading

gibson042 left a comment

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

gibson042 Apr 4, 2025

	// Send a chunk of a bundle to tolerate bandwidth constraints.
	// Send a chunk of an artifact to tolerate RPC message size constraints.

	// Either bundle, compressed_bundle, or bundle_chunks will be set.
	// Of the fields for (complete, uncompressed) bundle, (complete) compressed
	// bundle, and chunked bundle, exactly one must be non-empty.

		// MsgInstallBundleResponse is an empty acknowledgement that an install bundle
		// message has been queued for the SwingSet kernel's consideration.

-// MsgInstallBundleResponse is an empty acknowledgement that an install bundle
-// message has been queued for the SwingSet kernel's consideration.
+// MsgInstallBundleResponse is either an empty acknowledgement that an install
+// bundle message has been queued for the SwingSet kernel's consideration, or
+// (for install bundle messages that specify chunking) a container for the
+// assigned id with which chunks must be associated.

-  // Doubly-linked list in order of start block and time.
-  uint64 first_pending_id = 2 [
-    (gogoproto.jsontag)    = "first_pending_id",
-    (gogoproto.moretags)   = "yaml:\"first_pending_id\""
-  ];
-  // The last pending id that has not expired or completed.
-  uint64 last_pending_id = 3 [
-    (gogoproto.jsontag)    = "last_pending_id",
-    (gogoproto.moretags)   = "yaml:\"last_pending_id\""
-  ];
+  // The head of a doubly-linked list of pending chunked artifacts ordered by
+  // ascending start block and time (i.e., the ID of the oldest).
+  uint64 first_chunked_artifact_id = 2 [
+    (gogoproto.jsontag)    = "first_chunked_artifact_id",
+    (gogoproto.moretags)   = "yaml:\"first_chunked_artifact_id\""
+  ];
+  // The tail of a doubly-linked list of pending chunked artifacts ordered by
+  // ascending start block and time (i.e., the ID of the youngest).
+  uint64 last_chunked_artifact_id = 3 [
+    (gogoproto.jsontag)    = "last_chunked_artifact_id",
+    (gogoproto.moretags)   = "yaml:\"last_chunked_artifact_id\""
+  ];

feat(cosmos): mitigate install-bundle RPC limits by chunking #11202

Are you sure you want to change the base?

feat(cosmos): mitigate install-bundle RPC limits by chunking #11202

Conversation

michaelfig commented Apr 2, 2025

Description

Security Considerations

Scaling Considerations

Documentation Considerations

Testing Considerations

Upgrade Considerations

cloudflare-workers-and-pages bot commented Apr 2, 2025 • edited Loading

Deploying agoric-sdk with Cloudflare Pages

gibson042 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

feat(cosmos): mitigate `install-bundle` RPC limits by chunking #11202

feat(cosmos): mitigate `install-bundle` RPC limits by chunking #11202

cloudflare-workers-and-pages bot commented Apr 2, 2025 •

edited

Loading